基于自然语言处理的JavaScript引擎定向模糊测试技术  

Directed Fuzzing Technology of JavaScript Engine Based on Natural Language Processing

作　　者：吴泽君 武泽慧 王允超[1] 魏强[1] WU Zejun;WU Zehui;WANG Yunchao;WEI Qiang(Information Engineering University,Zhengzhou 450001,China)

机构地区：[1]信息工程大学,河南郑州450001

出　　处：《信息工程大学学报》2022年第6期737-745,共9页Journal of Information Engineering University

基　　金：国家重点研发计划课题资助项目(2020YFB2010902)。

摘　　要：JavaScript语言广泛用于浏览器和其他应用程序中,针对JavaScript引擎的攻击给企业和用户带来了巨大的安全隐患。当前针对JavaScript引擎的模糊测试技术在可用测试用例生成能力和代码覆盖率方面存在不足,经研究提出了一种基于自然语言处理的JavaScript引擎定向模糊测试技术,使用简化的BERT语言模型和残差网络提取JavaScript语法语义信息,并生成用于定向模糊测试的测试用例。实现的原型工具JSBFuzz选择JerryScript、ChakraCore和JavaScriptCore进行测试,累计发现9个BUG。实验结果表明,JSBFuzz能够大幅提高JavaScript测试用例的生成效率和漏洞挖掘速度,并且具有较高的代码覆盖率。JavaScript is widely used in browsers and other applications. Attacks against JavaScript engines have brought huge security risks to enterprises and users. At present, the fuzzing technology for JavaScript engine is insufficient in terms of available test case generation ability and code coverage. To address this, directed fuzzing technology for JavaScript engine based on natural language processing is proposed. The simplified BERT language model and residual network are used to extract the JavaScript language syntax and semantic information to generate test cases for directed fuzzing. The prototype tool JSBFuzz selects JerryScript, ChakraCore and JavaScriptCore for testing, and finds 9 bugs in total. The experimental results show that JSBFuzz can greatly improve the efficiency of JavaScript test case generation and the speed of vulnerability discovery, and has a high code coverage as well.

关 键 词：定向模糊测试 JAVASCRIPT引擎 自然语言处理 残差网络 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]